WHERE’S THE BEEF? - Top Draw · T HREATS E XPLAINED –B RUTE F ORCE A TTACKS Peter Abraham over...
Transcript of WHERE’S THE BEEF? - Top Draw · T HREATS E XPLAINED –B RUTE F ORCE A TTACKS Peter Abraham over...
WHERE’S THE BEEF?
Beefing Up Your WordPress Installation
Tammy Valgardson – Senior Web Developer
@tammalee
INT
RO
DU
CT
ION
Absolutely true! It will only take five minutes
to download and install WordPress.
Introduction
But then what?
INT
RO
DU
CT
ION
Introduction
If you set up your blog and walk away,
you leave yourself vulnerable to malicious activity!
Further Reading
WordPress Codex – Hardening WordPress
http://codex.wordpress.org/Hardening_WordPress
How To: Stop The Hacker By Hardening WordPress
http://blog.sucuri.net/2012/06/how-to-stop-the-
hacker-by-hardening-wordpress.html
INT
RO
DU
CT
ION
If you don’t follow password best practices your hacked WordPress account
could lead to other compromised accounts!
What’s at Stake?
INT
RO
DU
CT
ION
What’s at Stake?
Shared hosting means more than just
sharing a server.
If one site gets hacked there is a chance
malware infecting one site can spread to
others on the same shared hosting
space!
INT
RO
DU
CT
IONIf your site is compromised, and hackers get their way, your site will now
serve a nefarious purpose such as:
What’s at Stake?
Hijack links to other sections of your web site, such as
‘Contact’, and send visitors to an entirely different site.
Compromise a shared hosting (soup kitchen)
server and infect other web sites.
Redirect visitors to a web site that
will attempt to install malicious software.
Phish for sensitive information.
Display spam to your visitors that you can’t see.
INT
RO
DU
CT
IONIf your WordPress site is infected with malware it could be blacklisted by
Google and other search engines!
What’s at Stake?
[ Source: http://www.malware-info.com/mal_faq_inject.html ]
THREATS EXPLAINED – BRUTE FORCE ATTACKS
a.k.a. When bored hackers with password cracking programs
decide to cruise for fun on a Friday night.
TH
RE
AT
SE
XP
LAIN
ED
–B
RU
TE
FO
RC
EA
TT
AC
KS
What is a brute force attack?
[ Source: http://www.inmotionhosting.com/support/website/wordpress/wordpress-security-preventing-brute-force-attacks-on-admin-
login ]
TH
RE
AT
SE
XP
LAIN
ED
–B
RU
TE
FO
RC
EA
TT
AC
KS
Peter Abraham over at DNI Dynamic Net, Inc. wrote on October 15, 2012 “If you asked me from
September 2012 forward, the answer would change dramatically with WordPress Brute Force
Attacks now exceeding 50% of all attacks being reported.”[source: http://www.dynamicnet.net/2012/10/wordpress-brute-force-attacks/]
How often do brute force attacks happen?
Brute force attacks happen all the time!
[ Source: http://freethegnu.wordpress.com/2010/09/22/yet-another-ssh-brute-force-attack-and-how-to-protect-against-it-with-iptables-and-sshguard/ ]
TH
RE
AT
SE
XP
LAIN
ED
–B
RU
TE
FO
RC
EA
TT
AC
KS
If your account has administrator permissions they can do all sorts of ‘fun’ things to your site.
One of the most common reasons for a brute force attack is to inject malware into your files or database.
What’s the purpose of a brute force attack?
THREATS EXPLAINED - MALWARE
Not Firefly-related.
Not that I’d mind Captain Malcolm Reynolds getting into my
WordPress installation.
#fullfrontalnerdity
TH
RE
AT
SE
XP
LAIN
ED
-M
ALW
AR
E
What is Malware?
Malware is software designed to harvest sensitive information or gain access to computer
systems. On a WordPress installation malware can be injected into your source code, database,
.htaccess files etc.
Malware hijacks the purpose of visiting your site for its
programmed agenda.
Who Creates Malware?
What sort of person creates malware?
• Young programmers with something
to prove
• Older, more experienced, virus
writers who write malware
professionally
• ‘Researchers’ who create malware
as proof of concept projects
Why?
Why do people create malware?
• Petty theft
• Cybercrime
• Support for spammers
• Distributed network attacks
• Stealing electronic currency
• ...and many more.
[Source: http://www.securelist.com/en/threats/detect?chapter=72 ]
TH
RE
AT
SE
XP
LAIN
ED
-M
ALW
AR
E
Malware - Backdoors
“A backdoor lets an attacker gain access to
your environment via what you would
consider to be abnormal methods — FTP,
SFTP, WP-ADMIN, etc…”
[ Source:
http://wp.smashingmagazine.com/2012/10/09/four-
malware-infections-wordpress/ ]
Malware - Drive-by Downloads
“The point of a drive-by download is often to
download a payload onto your user’s local
machine. One of the most common payloads
informs the user that their website has been
infected and that they need to install an anti-
virus product...”
[ Source:
http://wp.smashingmagazine.com/2012/10/09/four-
malware-infections-wordpress/ ]
Malware – Malicious Redirects
“When a visitor is redirected to a website other than the main one, the website may or may not contain a malicious payload. Suppose you have a website at myhappysite.com; when someone visits it, the website could take the visitor to meansite.com/stats.php, where the malicious payload is in that website’s stats.php file. Or it could be a harmless website with just ads and no malicious payload.”[ Source: http://wp.smashingmagazine.com/2012/10/09/four-malware-infections-wordpress/ ]
TH
RE
AT
SE
XP
LAIN
ED
-M
ALW
AR
E
Malware – Pharma Hacks
“Pharma hack is one of the most prevalent infections around. It should not be confused with
malware; it’s actually categorized as SPAM — “stupid pointless annoying messages.” If you’re
found to be distributing SPAM, you run the risk of being flagged by Google…”
[ Source: http://wp.smashingmagazine.com/2012/10/09/four-malware-infections-wordpress/ ]
[ Source: http://www.pearsonified.com/2010/04/wordpress-pharma-hack.php ]
TH
RE
AT
SE
XP
LAIN
ED
-M
ALW
AR
E
Old and outdated plugins, themes, and WordPress installations may have holes in their security
that can be exploited.
Malware is injected into a file or your database where it hijacks your visitors experience when
they visit your web site. It's written using a Web 2.0 language, usually PHP, Javascript, Ruby,
Perl, etc. Because WordPress is so widely distributed and open-source there is not only an
excellent chance there are outdated installations with security holes but the code of those
installations is free for a hacker to study.
Third-party plugins and themes may have backdoors coded into them that allow access to
hackers. (eg. Tim Thumb hack)
How does malware infect WordPress?
[ Source: http://www.intechgrity.com/timthumb-vulerability-how-it-got-hacked-how-to-recover/# ]
TH
RE
AT
SE
XP
LAIN
ED
-M
ALW
AR
E
How do I know I’m infected?
• Formatting/theme is altered
• You run a plugin that tells you
• Links/text have been inserted at the
bottom of the website
• Warning in search results
• Browsing the website with Google
Chrome results in a warning
Plugins that help scan your site
Sucuri Sitecheck Malware Scaner
http://wordpress.org/extend/plugins/sucuri-
scanner/
WordFence Security
http://wordpress.org/extend/plugins/wordfe
nce/ (Multi-site support in beta!)
TH
RE
AT
SE
XP
LAIN
ED
-M
ALW
AR
E
• Google Webmaster Tools messages [ www.google.com/webmasters/tools/ ]
• Google’s pretty good about notifying webmasters when it sees weird stuff going on.
Example:
How do I know I’m infected?
Notice of Suspected Hacking on http://www.yourwebsite.com/
May 17, 2012
Dear owner or webmaster of http://www.yourwebsite.com/,
We are writing to let you know that some pages from
http://www.yourwebsite.com/ will be labeled as potentially
compromised in our search results. This is because some of your
pages contain content which may harm the quality and relevance of
our search results. It appears that these pages were created or
modified by a third party, who may have hacked all or part of your
site. Many times, they will upload files or modify existing ones,
which then show up as spam in our index.
The following are some example URLs which exhibit this behavior:
TH
RE
AT
SE
XP
LAIN
ED
-M
ALW
AR
EIf you have an infection, I highly recommend hiring Sucuri.net to
clean it up for you. They specialize in removing malware
infections and they’re quick, specialized, and inexpensive.
How do I get rid of Malware?
sitecheck.sucuri.net/scanner
Scan your Web site for possible infections by using the free service below:
You could hire a developer to comb through your infected code, database, and
.htaccess files. However, most developers don’t specialize in malware removal
and when you pay an hourly rate for that inexperience you may be better off
hiring a specialist.
PASSWORDS & ADMINISTRATIVE USERS
If you’re starting to fall asleep, wake up!
This is the most important section I’ll be talking about today.
YO
UR
PA
SS
WO
RD
& A
DM
INIS
TR
AT
IVE
US
ER
S
Creating your Password
When creating a password, do NOT use:
• Your birthdate, wedding
anniversary, or dates of birth of your
children or spouse
• Your name, username, company
name, names of your children or
spouse
• Your SIN number
• Only numbers or only letters
• A short, easy to remember,
password
• The word, ‘password’. No, not even
‘password01’ or ‘password2012’
• No words found in a dictionary of
any language (BUT WAIT! We’ll talk
about multi-word passwords very
soon!)
Further Reading
Common passwords to avoid
http://www.labnol.org/internet/common-
passwords-to-avoid/14136/
Avoiding Common Passwords
http://www.passworddragon.com/avoid-
common-passwords
YO
UR
PA
SS
WO
RD
& A
DM
INIS
TR
AT
IVE
US
ER
S
Creating your Password
When creating a password, do use:
• At least 10 characters
• A mix of numbers, upper and lower case letters, and special characters
• A password you have never used before
• Have a system or mnemonic
Password Generatorwww.StrongPasswordGenerator.com
Got to Password Meter to test the strength of your new password - www.PasswordMeter.com
Brute Force calculator: https://www.grc.com/haystack.htm
Further Reading
Salting Passwords
http://www.onextrapixel.com/2011/11/02/w
ordpress-security-how-to-secure-wordpress-
thoroughly/
YO
UR
PA
SS
WO
RD
& A
DM
INIS
TR
AT
IVE
US
ER
S
Creating your Password – Multi-word combo passwords
[ Source: http://xkcd.com/936/ ]
YO
UR
PA
SS
WO
RD
& A
DM
INIS
TR
AT
IVE
US
ER
S
Multi-word combo passwords
Multi-word combo passwords are more likely
to be remembered but there are a few things
to consider:
• The words must be random
• The words must not relate
• Throw in upper & lower cases
• Throw in numbers
• Throw in special characters
“Numbers substituted for letters is really,
really bad. Most password applications will
try that before they do plain English,...”[ Source: http://www.nettechblog.com/yes-your-
passwords-suck-hints-on-creating-solid-passwords/ ]
Test your password out
https://www.grc.com/haystack.htm
My coworker came up with and tested:
Staple2Deers@dawn
And found it would take 1.34 billion trillion
centuries to crack using brute force.
Further Reading
Which are more secure, multi-word
passwords or passwords made using a
combination of letters, numbers and
symbols?
http://www.quora.com/Which-are-more-
secure-multi-word-passwords-or-passwords-
made-using-a-combination-of-letters-
numbers-and-symbols
YO
UR
PA
SS
WO
RD
& A
DM
INIS
TR
AT
IVE
US
ER
S
Remembering your Password
DO NOT store it in an obvious place!
• NOT on a sticky note on your monitor
• NOT in your daily planner
Use a Password Keeper
• www.keepass.info
• https://agilebits.com/OnePassword
• http://www.lastpass.com
Don’t Panic!
Password recovery is built into WordPress!
YO
UR
PA
SS
WO
RD
& A
DM
INIS
TR
AT
IVE
US
ER
S
Password Recovery
Always keep your email up to date on your WordPress site!
YO
UR
PA
SS
WO
RD
& A
DM
INIS
TR
AT
IVE
US
ER
S
Strong, Unique Passwords aren’t just for WordPress
The way you communicate with your web host should also be secure. You want strong
passwords for:
• Your cPanel user
• Your FTP user (which you should make different from your cPanel user)
• Your MySQL database user
• Your PHPMyAdmin user
Use SFTP to move files to your hosting space
Try to use SFTP for your file transfers. SFTP
stands for Secure File Transfer Protocol and it
uses encrypted SSH transport for it’s
operations.
Every password should be different!
If you use a different password for
every service you have accounts for,
you minimize the amount of
damage a hacker can do!
http://filezilla-project.org/
YO
UR
PA
SS
WO
RD
& A
DM
INIS
TR
AT
IVE
US
ER
S
Administration Users
Create a new administrator user
1. Log into WordPress as your current
admin
2. Create a new user
3. Give it a name other than Admin or
Administrator
4. Assign your new user an ‘administrator’
role
Remove your old administrator user
1. Log into WordPress as your new admin
user
2. Go to Users and delete your old admin
user
3. Or, set your old Admin user’s role to
‘subscriber’ and change the password to
something ridiculously long and complex
If you have an administrator-level user
named ‘Admin’ or ‘Administrator’
get rid of it!
YO
UR
PA
SS
WO
RD
& A
DM
INIS
TR
AT
IVE
US
ER
S
Administration Users
You don’t need to write posts as an administrator! Keep your administrator user separate from
your blog-writing user. Hackers can find your username from your posts
If you go to Your Profile you can change what your name is displayed as. I recommend changing
this from the default of your username to something else.
Clean up old admin accounts
If you’ve got old admin accounts sitting around – like ones that you’ve created for developers to work on your site with, remove them.
Not all of your users need to be administrators, either. If you have contributors to your site, test out various settings to see how much access they really need.
PASSWORD STRENGTH IS KEY!
The best security for your administration user
is having a strong password
Make sure you reset your admin passwords
on a regular basis and make sure you haven't
used that password elsewhere before!
UP
DA
TE
S&
HO
US
EK
EE
PIN
G
Updates
The majority of hacked WordPress sites
are not updated!
Updates include:
• Core WordPress files
• Themes
• Plugins
[ Source: WPbeginner.com ]
Outdated WordPress files, themes,
and plugins can have holes in security
that can be exploited by malware!
UP
DA
TE
S&
HO
US
EK
EE
PIN
G
Challenges to Updating
Theme hasn’t been coded according to WP
best guidelines and the site breaks if you
upgrade.
Plug-in has been abandoned by the
developer and you’re afraid to update your
core files or you continue using the plugin
years after it’s been abandoned.
You’re afraid to update because you’re not
very web-savvy.
Recommended Reading
Abandoned Plugin Suggestion
Matt Jones (http://pluginchief.com/)
suggests a plugin adoption program:
http://digwp.com/2012/10/abandoned-
plugin-adoption-program/
WordPress Codex: Updating WordPress
http://codex.wordpress.org/Updating_Word
Press
UP
DA
TE
S&
HO
US
EK
EE
PIN
G
Backing up before updating
Using an SFTP program (filezilla-project.org),
back up all your web files to your
Computer.
Using PHPMyAdmin or cPanel to back your
database up.
Never leave .sql or other database backup
files on your server!
Update Now!
WordPress Codex: WordPressBackups
http://codex.wordpress.org/WordPress_Back
ups
http://vaultpress.com/
It’s not free but it’s highly recommended.
UP
DA
TE
S&
HO
US
EK
EE
PIN
G
Safety First! Safe themes and plugins
Curtis McHale, who spoke at WordCamp Edmonton 2011 (you can view his slide show here:
http://www.slideshare.net/curtismchale) is part of a team that checks themes submitted to the
WordPrss.org repository to make sure they are secure and well-formed.
If you are interested in joining the WordPress Theme Review Team:
http://make.wordpress.org/themes/about/how-to-join-wptrt/ This page has a list of useful
plugins that they use to examine a theme and may be useful for anyone developing their own
theme.
http://www.woothemes.com/
Has a good reputation for paid themes.
http://wordpress.org/extend/themes/
Themes are vetted by teams of
Volunteers and are free.
Nothing is 100% un-hackable!
UP
DA
TE
S&
HO
US
EK
EE
PIN
G
Housekeeping
Don't leave files on your server that may give
hackers information about yours site or old
code that may be exploitable:
• .sql backups
• readme files
• inactive plugins and themes
• Phpinfo.php
Further Reading
http://resources.infosecinstitute.com/harden
ing-wordpress/
http://wiki.dreamhost.com/Harden_WordPre
ss
How to: Stop the Hacker by Hardening WP
http://blog.sucuri.net/2012/06/how-to-stop-
the-hacker-by-hardening-wordpress.html
Removing WordPress Version
Altering your functions.php file:
http://www.wpbeginner.com/wp-
tutorials/the-right-way-to-remove-
wordpress-version-number/
UP
DA
TE
S&
HO
US
EK
EE
PIN
G
WP Security Scan
Use a plugin to change your database prefix
Also this plugin can help you change your
database prefix:
http://wordpress.org/extend/plugins/wp-
security-scan/
I use this plugin to scan my site on a regular
basis.
Manually change your database prefix
Change your database prefix
http://digwp.com/2010/10/change-
database-prefix/
If you are setting up a new WordPress site
the option is there to change your database
prefix when you first set it up.
UP
DA
TE
S&
HO
US
EK
EE
PIN
G
The scary world of CHMOD
Check permissions of upload, upgrade, and
backup directories
WordPress Codex – Changing File
Permissions:
http://codex.wordpress.org/Changing_File_P
ermissions
Equally scary .htaccess!
.htaccess is a powerful file when used correctly! You can use it to secure:
• wp-config.php
• set up admin access from your IP only
• ban bad users
• stop directory browsing
• prevent access to /wp-content/
• protect your .htaccess file!
Protect Your WordPress Site with .htaccess
http://www.netmagazine.com/tutorials/protect-your-wordpress-site-htaccess
Securing directories with .htaccess: http://digwp.com/2012/09/secure-media-uploads/
How to Password Protect your WP Admin
http://www.wpbeginner.com/wp-tutorials/how-to-password-protect-your-wordpress-admin-wp-admin-directory/
If you change your permalink
structure any customization
on your .htaccess file may be
overwritten!
HO
ST
ING
Hosting
When it comes to hosting, you get what you
pay for. $5/month hosting is cheap but it’s
not terribly secure. You take your chances
with shared hosting.
How to identify a good WordPress host?
A good WordPress host will mention what
steps they take to provide you with a secure
hosting environment or how they cater
specifically to WordPress installations.
Sadly, many bloggers are paid to shill for
hosting companies so you have to do your
due diligence when it comes to picking a
host.
Good Hosts (caveat emptor)
Recommended on WordPress.org
Bluehost: http://www.bluehost.com/
DreamHost: http://www.dreamhost.com/
Laughing Squid: http://laughingsquid.us/
Recommended by WooThemes
WPEngine: http://wpengine.com/
Examples of good hosts
Hardening WordPress on Dreamhost
http://wiki.dreamhost.com/Harden_WordPre
ss
WP Engine’s list of disallowed plugins
http://support.wpengine.com/disallowed-
plugins/
PLU
G-IN
S
Plugins
Plugins are not the be all and end all when it
comes to security.
That being said, here are some plugins you
may find useful. Don’t use them all at once!
Malware Scanning / Blocking
Sucuri Sitecheck Malware Scanner
http://wordpress.org/extend/plugins/sucuri-
scanner/
Block Bad Queries:
http://wordpress.org/extend/plugins/block-
bad-queries/
Brute Force Blocking
User Locker:
http://wordpress.org/extend/plugins/user-
locker/
Limit Login Attempts:
http://wordpress.org/extend/plugins/limit-
login-attempts/
General Security
Wordfence Security:
http://wordpress.org/extend/plugins/wordfe
nce/
WP Security Scan:
http://wordpress.org/extend/plugins/wp-
security-scan/
CO
NC
LUS
ION
In Conclusion
There are many more tips and tricks than
what I’ve covered here but I’m trying to keep
things simple.
Try as you might your security will never be
perfect but the good news is you can easily
make yourself less of a target by taking a few,
simple, security precautions.
Knowing how to protect yourself is the first
step towards a safe, secure WordPress site.
(The second step is to actually implement
some of this advice.)
Recommended Reading
http://my.safaribooksonline.com/book/-/9781849512107
http://blog.sucuri.net/category/wordpress
http://codex.wordpress.org/Hardening_WordPress
http://blogvault.net/wordpress-security-1-securing-wp-config-php/
http://www.copyblogger.com/wordpress-website-security/
http://www.wpsecuritylock.com/dreamhost-one-click-wordpress-installed-timthumb-vulnerability-and-security-risks/
http://www.instantfundas.com/2011/12/quick-guide-to-secure-wordpress-setup.html
CR
ED
ITW
HE
RE
CR
ED
ITIS
DU
E
Credits:Cow hide photo in title graphic by Sherrie Thai of ShaireProductions
http://www.flickr.com/photos/shaireproductions/3766840922/
Bashful Cow purchased from istockphoto.com
“Let’s have fun” scary graphic purchased from istockphoto.com
Herd Infection photo purchased from istockphoto.com
Social Media icons from respective social media web sites
‘Common passwords to avoid’ poster
http://www.etsy.com/listing/52531459/500-worst-passwords-poster-fold-down
Special thanks to:Adriel Michaud @ TopDraw.com for his input
Sarah Sinfield @ KickPoint.ca for encouraging me
Curtis McHale @ CurtisMcHale.com for inspiring me
My partner who makes sure my fuzzy blanket supply never runs out